What if every keystroke you typed was recorded? Programs that do this have existed for years, and are often traded on shadowy Web sites. Alone, they are mere curiosities, but when coupled with Trojan horses that send the data over the Internet, these so-called keystroke loggers allow malicious users to steal your passwords and credit card numbers.
Now the U.S. government wants to use similar keystroke-logging-enabled Trojan horses in the war against terrorism, and two U.S. antivirus companies have announced they'll look the other way.

SIMPLY PUT, a keystroke logging program is a memory application that records every keystroke a user makes on a given computer. Most keystroke loggers record the application name, the time and date the application was opened, and the keystrokes associated with that application. For example, when you open Outlook and write an e-mail, the keystroke logger would record your e-mail address, the subject line, and any body text you type.




Some keystroke loggers are advertised as child-protection programs, as they allow parents to see which sites their children have visited, or what their children typed during online chats. Keystroke loggers are also advertised as a means for companies to "assess" their employees' work habits. But this technology gets really pernicious when a malicious user couples it with a Trojan horse, as was the case with the recent Badtrans.B worm.

Often, keystroke loggers track what you type in popular Web browsers. Lately, though, new loggers record the passphrase you enter into encryption programs such as PGP. The passphrase is a series of words that access your encryption key. Once malicious users obtain your passphrase, they can use your encryption key, and therefore decrypt any information you have encrypted.

THE U.S. GOVERNMENT wants to use these encryption-keystroke loggers to find criminals and terrorists. In a recent and highly publicized loan shark and racketeering case in New York, FBI agents obtained information using an encryption-keystroke logger placed on computers in suspected mobster Nicodemo Scarfo's New Jersey office. According to MSNBC, agents did so by breaking into the Scarfo office and individually installing the logger on each computer. (I'll leave the question of whether or not the government should be able to "steal" encryption keys for another column.)

Code-named "Magic Lantern," the bureau's new project would essentially create a government-sanctioned Internet worm that would self-install encryption-keystroke loggers on chosen computers. Agents would still need to obtain a court order before "infecting" someone, however the U.S. Patriot Act passed in October requires authorization only from a state or U.S. attorney general at first; a judge's order isn't needed until later. One method of distributing the encryption-keystroke loggers involves having a friend or relative of the person under investigation send him or her an infected e-mail. Of course, this could only happen if the suspect's antivirus program didn't first detect the FBI's Trojan horse.

SO FAR, Symantec and Network Associates have said their software will not detect the presence of this FBI Trojan horse. It should be noted that antivirus products already exclude some files from their scans, though none are as powerful as Magic Lantern. No antivirus software vendors outside the U.S have weighed in on this matter yet.

Shane Coursen, a SecurityFocus columnist and CEO of WildList Organization International, a group that tracks viruses in the wild, predicts that any such collusion with the FBI might begin the downfall of U.S. antivirus software maker's dominance worldwide. I think the real danger lurks in the FBI borrowing a page from a malicious user's notebook. Even if every antivirus vendor in the world agreed to exclude the FBI's Trojan, the shadow Web sites already used by malicious users would start hosting custom Magic Lantern detection programs. Once such a tool is available, the FBI's magic would be useless.

Facts And Factors That
May Inhibit A PI From Executing His Task

There are quite a number of "inhibiting facts and factors". Some may only
effect an investigator locally or nationally. But when working internationally he may encounter others completely different or additional to those he confronts locally or nationally. Also their local impact may differ to the national or international counterparts.

There are numerous "inhibitors". Many will agree that
legal aspects play a major part as inhibitors of which the Data Protection Act (DPA) major of which the DA, the greatest.

Financial factors such as the lack of education as well as training and equipment further important barriers
Cultural barriers
Language barriers
Technical barriers: equipment not yet available to facilitate investigation
Lack of data stored or just not available online.

Cyberspace is considered by many to be the real final if not the newest frontier. It is also one that investigators can exploit as a major investigative resource. Armed with modems and computers, investigators can reach out to each other around the world via computer keyboard. Online services can be useful tools, when deployed wisely. [1]

Investigators must convert huge amounts of information into knowledge. With busy schedules and economic pressures, they are forced to efficiently and economically transform a glut of information into genuine insight with the help of the Internet's collaborative tools. Computers and online services are investigative tools that are here to stay. The challenge is to harness the technology in ways to help investigators handle their jobs better and faster thus transforming Internet from toy to tool. [1]

Potential Impediments to Investigators of any kind

Many investigators believe to be too old to take the challenge and invest
time, money but also nerves in getting acquainted with the new fascinating new world. Consequently some have either amalgamated their business with
those of others nilly willy because of lack of financial means. Other
investigators have totally given up and closed their business altogether.

Other investigators are so overloaded with cases that they have little time to log on to the Internet, even if they were empowered to do so by their superiors. The latters may be afraid that instead of handling cases or checking legal precedent cases to support a claim denial for the benefit of their companies, the investigators may surf the Internet for their own pleasure [1]. The possibilities are abundant: from watching porno sites, booking a journey or bidding on eBay.

Superiors are much concerned about that waste of time and money, they try to regulate it by inserting special equipment to record such not permitted surfing. For doing this they either insert a paragraph in the work contracts or ask the union representative to agree to such measures.
Yet research has shown that productivity is less impeded by certain private surfing than no surfing. Since a happy employee is a better working employee. This has been meanwhile taken into consideration in appertaining legal and work regulations, even in Germany which is rather slow in taking up such things compared to the USA.

Some superiors are afraid that investigators of different companies may compare notes on the Internet thus open a door to constituting collusion among competitors, perhaps triggering antitrust claims. [1]

The author of this essay believes that the greatest inhibitor to investigators is the Data Protection Act (DPA) (US), also known as the Right of Privacy Act (UK). The DPA is not the only legal aspect which hinders an investigator in doing his job. Although the Americans have
initiated this legal aspect, it is least strictly applied to as yet there, although things change presently. In many countries it is illegal to undertake investigations of any sort (Arabian countries,
Franco Africa for instance).

Mr. Riddle [2] discusses who to locate hidden assets, an important investigative field of activities, a need resulting from various reasons, e.g. because of divorce proceeding, a person or a company having declared bankrupt, somebody not wanting to pay the damage to a car or a person because his insurance company does not cover the damage and declaring that he does not have the means to settle the damages.

An insurance company may try to locate assets to reclaim the money spent to their insured, businesses conduct hidden asset investigations before entering into business dealings with another company or person to make sure they are financially stable.

Mr. Riddle concedes that handling such an investigation it is important
to get information about the debtor, first from the client, then from other sources. Ideally the debtor's credit report would be a great mean to obtain such needed information, but it is illegal in the light of the DPA [3] to obtain such without the debtor's permission except in a few cases. It is very clear and understandable that the debtor will not issue
such.

To help the client Mr. Riddle advises to provide a "financial profile."
One means to that end is checking records such as those lodged with the
appertaining district civil and county civil courts. This may lead to
the investigator finding that the debtor has several lawsuits for
failing to pay debts or taxes. This result may stop the investigation
at this stage to save the client money, thus avoiding throwing good
money after bad.

This sort of search is not available in Europe on account of the DPA.

But the client may still wish to continue with the investigation nonethe-
less, especially if on account of his long standing experience the conscientious investigator has a feeling that there is still a chance to
find hidden assets. The investigator may even take it as a challenge
stating that he will not charge anything or a nominal fee if the findings
after all prove that the debtor is indeed financially broke.

In the USA the social security number is still the key to open locked
doors, i.e. to start the investigation with. In the USA in most cases
one has the same social security number throughout one's life. In Germany
for instance it can be changed several times during a person's life time.

In Europe the DPA does not permit access to the social security number
records or the usage of it for investigation purposes, similarly there is no access to the driving records in many countries, e.g. Germany where even lawyers not involved in litigation with the driver in any manner is not allowed to get a copy of the records without a court order.

Mr. Riddle states that another useful tool is the good old tool of "dumpster diving." This means to search through the investigated person's
garbage. Many persons and companies are very negligence and careless when
throwing bank account documents or such from authorities, personal records or private lettres. They throw such documents without tearing them
apart, let alone running them through a shredder. In UK this is not permitted [3], there was even a court case well covered by the press against an investigator who did dumpster or garbage diving.

Mr. Riddle continues stating that the investigator should keep in mind trespassing laws, i.e. not entering private property, even in the
front garden. In this case, the dumpster was in an office complex readily accessible.



In Germany there is a big discussion as to whether the garbage is "forsaken" by the its producer even if dumped on the sidewalk, a public area. The legal view is that the garbage or dumpster albeit being in a public area is not "accessible" to third parties, but has been handed over to the garbage company so that they can use it to their liking within the framework of environmental laws and regulations. This means that the garbage company represented in the street by the garbage collectors may sell it for profit, destroy part or all of the garbage as it chooses.

That the government does not keep to the rules set by them themselves
can be well viewed by the article compiled by:

The US Federal Government does not apply the privacy regulations themselves [4]

He stated in his memorandum that the Federal Trade Commission (FTC), set out its own privacy principles in May 2000 in a report entitled
"Fair Information Practices in the Electronic Marketplace" when
regulating the commercial sector, forgetting however to regulate itself
and other governmental entities.

Rep. Billy Tauzin and Dick Armey asked the General Accounting Office (GAO) to apply the FTC's privacy criteria to the government itself. Not only
did the FTC fail to meet the very standards it had asked Congress to
impose on everyone else, so did 97 percent of all federal websites
surveyed.

The various governmental entities collection data from the citizens
maintaining that these data are needed to properly execute the entities'
tasks bestowed to them by the government. This would be in order to some
extend in the opinion of many citizens. But the governmental entities
do not stop there. They will routinely share data and information
with other agencies. That means citizens' complete life history are floating around the bureaucracy, whether the citizens like it or not. Some of this information sharing is beneficial, allowing agencies to work more efficiently. But too much is shared evading the citizens' privacy, thus curtailing their legal rights too much.

President Bill Clinton used his last hours in office to draft together a rule designed to protect the privacy of medical information. But buried
within the expansive text filled with new regulatory requirements for
health care providers is a passage giving the Department of Health and
Human Services the right to collect all personal medical records from a given health provider without a warrant or prior notice.

While the Americans put a high value on their privacy, still, when
interviewed in the framework of a mortgage application, a prospective
employment, a license, they are much more willing to supply information
compared by their European counterparts. If the Americans are willing to
answer 80 to 100% of the questions, the Europeans may answer at
the start only 40 - 60%, with much persuasion, showing that answering
the questions is for their own benefit, some further 20%.

The American e-commerce business in the largest sense of the word (not only the trading of goods but also supplying services) is by far more
developed than in other parts of the world because there are less impeding factors than elsewhere.

One reason of course is that the American computerised world is by far the most developed in the world, but also Americans are more willing to
supply their private data, incl. social security, credit card numbers
more readily than in other parts of the globe.

Another hindrance in cyberspace world is the lax security -still- prevailing. Mr. Dick Armey [4] stated that he has not yet undertaken the transition to online banking being afraid of the lax security online.

Those who run websites of any kind, especially the traders and those
offering services, must take the security angle very seriously to remain in business by imposing or accepting notice rules and standards on web sites most likely becoming relevant in the coming years.

So two great hindrances in handling investigations have been indicated:
privacy regulations, even handled in a lax way within governmental
organization but not to the private investigators for instance, as well as
security reasons permitting hackers to enter systems believed
to be secured, yet not available to third parties, e.g. the
private investigators.

It is important to know how the Internet and websites function.
They change considerably, since these media are still in the trial
stage, but they are here to stay.

Financial barriers (lack of education as well as training and equipment)

A great inhibitor or obstacle in handling investigation is the lack
of education, both general, legal or commercial to state a couple.

An investigator must be able to read and write well - at least in his own language: read: to understand the client's written instructions, sources, legal, commercial or any others needed to get on with the investigation,
write: letters asking for information in a correct language, e.g. in
a background investigation to the (ex) employer's human resources
department of an applicant. If the investigator's written application
does not concord with the least professional requirement, it is very
likely that he gets no answer at all or at least an unsatisfactory one
because of being too short to be of any use.



An investigator must also have a good legal knowledge and know where to
search for more if advice is needed in a specific instance. Much is available online these days [5], [9].

Even if investigators have a good knowledge in their field of investigation (many were police officers before turning to the private
industry), it is a fact that major traditional private investigation associations do not accept applicants as members unless they have been (self)employed for three years [10].

Police officers often have more possibilities to employ in order to undertake an investigation, e.g. accessing databases such as FBI records, not available to private investigators who legally are but private persons
and have to act like such.

The main reason for not accepting a police officer turned private investigator less than 3 years ago however is that a member of the law enforcement does not have the financial liability and extend of financial consideration as an private investigator has from an economic and commercial point of view. It takes several years to get accustomed to the economic and commercial "laws and regulations" prevailing outside
the law enforcement entities.

Ideally for a private investigator of course would be able to have access to all these databases and the possibilities as a law enforcement per-
son, but this is not possible: DPA forbids it.

As in any profession proper training is a most important factor in
successful investigation. With training comes experience not only knowing where to turn to in order to obtain the information needed to continue the investigation, but also using various means and modes of investigation to
successfully close the investigation. Training and experience also develop a "feeling", a hunch, how to undertake the investigation. This is an in-
valuable "means" which takes years to build.

Imagination and resourcefulness are also very helpful investigative means,
some investigators are well bestowed others less with these excellent
"tools". Moreover an investigator must be careful not to cross the legal boarder prescribed by his state or country laws, impeding him in his activities as well.

Lack of equipment is another great inhibitor. The lack of equipment may be the result of financial means missing, e.g. a surveillance van or a computer equipment cannot be acquired because the means needed are just beyond the investigator's financial resources.

But at times to rent the required equipment is also beyond and above an investigator's resources.

Even if he is able to rent the equipment from the financial point of view, in case he not have the proper training to handle the equipment, partly
because the need of this sophisticated equipment is rare, it is of no use. For instance the investigator has the means to rent or buy a Ferrari, but if he cannot drive it, he is better of with his old VW Beetle.

This is particularly valid for the use of the Internet.

The writer of this article tried to locate two Chinese companies to
be processed served. Two leading Chines agencies could not help. They are agencies of long standing, one located in Hong Kong, the other in Shanghai, both covering the whole of Mainland China, since they are
using the old mode of databases and commercial register records. The writer of this article therefore went online to search the Internet. There
the companies were listed in detail, including the names of the
executives, a most important information from the process serving angle.
Furthermore the history of the companies, their lines of business, subsidiaries etc. These data were of use to add what the writer calls "more icing to the cake", thus improving the quality of the reports and impressing the client, the aim being to have the client coming again to the investigator with new assignments.

Cultural barriers are also big inhibitors.

Assuming that two investigators speak the same language perfectly, nonetheless they may not understand each other. This sounds illogical, but experience has proved it often enough. Already between USA and UK there are linguistic and cultural differences.

Here is a simple example which the writer quotes to demonstrate this statement: In Great Britain one pays the bill (invoice) with a cheque, while in the USA one pays the check (invoice) with a bill. So if a
British customer in an American restaurant asks for a bill, the American
waiter will most likely be enraged, since he is asked to pay money on
top of the expenses incurred through the meal and drinks.

Thus different cultural background and upbringing may lead the investigator in a foreign country accept the assignment, but "understand" the requirements in a different way than intended.

For instance when an American colleague asks the writer of this essay to recommend an investigator in Iran, the latter tries to persuade the American counterpart to forsake this his idea, but allow the writer to oversee the investigation, act like a "translator" or "catalysator"
between the American and the Iranian investigators. The aim is
not only "translating" the investigative requirement, but also
discuss the possibilities available legally in Iran in contrast
to those in the USA in order to ultimately still handle the case successfully, figuratively speaking, the American investigator may turn left in order to reach his goal whereas his Iranian counterpart turns right and both will reach the aim nonetheless.

The difference in culture and consequently the difference in language
usage may be a big inhibitor too.

Americans are much more easygoing, they consider etiquette much less
seriously. They use first names terms immediately, also in instances
where they have had no contact with their counterparts ever before. In Germany this is a big faut pas. One is addressed by Mr. or Mrs./Miss,
often adding the recipient's title, such as Dr. Miller. In Austria
they go further addressing a person by his (professional) title (Herr
Geheimrat Mller) or a higher grade than in reality (Herr Baron when a person is a learned man). Letters are also more formally composed.
In the USA a writer may close with only "Jack" . In France a business letters closed with "Nous vous prions, Monsieur, d'agrer nos salutations les plus distingues" (We ask you, dear Sir, to accept our most respectful
greetings") or similar phrases. These days things get a bit laxer these days, perhaps under the influence of the USA and in the wake of globalization.

So if there is a cultural or language barrier, an investigation most
likely will not be carried out as well as it should, because beside
the above mentioned causes, there is also the human touch which may
play a bigger role than thought of. The foreign investigator accepting
the assignment may be angry at the lax way he has been addressed. He
may perhaps not be aware of his resentment, it is only be subconsciously there, yet it adversely effects the foreign investigator's quality of handling. It is the same thing if one does a job but his heart is not with it.

Here the writer as the "interpreter" or "catalysator" can avoid trans-
ferring the instructions the American way, putting them in a more formal manner or if this is not possible, explaining the cultural differences, thus expressing an indirect "excuse" on the part of the American investigator.

Technical barriers (equipment not yet available to facilitate
investigation)

When documents are scanned, at present the scanned material is in an
"image" format, meaning that the researcher must either read the complete
document to find what he is really looking for or copy it into a text or
word processor, then search for the topic needed for with the "find"
facility.

With short documents it may be quicker to skim through the document with
one's eye, with longer ones, the search facility still may be cumbersome.
The ideal situation would be that the scanner is at the same time a search
tool.

To use a video camera for instance during the interview of an applicant for a job, a claimant in an insurance case, may not be possible in many
countries since the equipment is not available either because the
quality is not so good as to really make use of the interviewee's re-
action to the full (the pictures do not yet run smoothly), or the price
of such an equipment say in Eastern Europe is so exorbitant that an
investigator cannot employ such an equipment for his daily use. If this kind of a tool -quite useful in some cases- is really needed, hopefully he can rent it from someone, or better subcontract the recording to a colleague who owns the equipment and is well versed with it. But this is surely done in rare cases because of the high fees involved, which the client for whom the investigation is carried out, will or is not able to accept the fee generated.

A car tracking device is propagated [6] for tracking private cars by means
of a GPS system. It is to be used to follow the movements of a vehicle
without following or tailing it. It can be plugged into a cigarette lighter for the electricity needed to run it.

The system also supplies a complete map with date, time, location and speed of travel as well as stops.

Although the device may be a good record keeping tool for business owners, independent contractors and individuals who need support to document their taxes, mileage and billing time as well as employers who want to keep an
eye on their employees (if legally permitted), a woman on her husband's
doing, parents checking their offsprings' activities, yet without a
proper map, which may not be yet available in China for instance, it cannot be used to its fullest.

The writer of this essay does not discuss here the legal side of using such a device.

Ideally a private investigator is allowed to access the car, build in
it the device and then watch its movements by means of his computer in
his office, but in many instances it is not possible to access the car legally, or when permitted by the suspicious wife or employer to access the vehicle, there is no cigarette lighter to provide the needed electricity.

Ideally video camera in the house or in a car helps to check the activities of a spouse, or an employee (with the permission of the union representative), and what is more, the spouse or the employee cannot shut down the surveying device, or if they think they have, the investigator has the means to activate the camera in such a way that the surveyed persons have no knowledge of it. But such devices are not available -yet-. And even if they are available one day, the legal and/or the financial issues will hinder the use of the video camera in many instances.

Lack of data stored online and the lack of access to data already stored
online.

Online availability of information to the public at large really started in about 1995/6 although some information was available already earlier of course [11], first with a few trials and errors, but the speed of lodging or linking available information by means of the Internet got on with amounting speed.

According to a study published in the July 8, 1999 issue of NATURE, the
world wide web was then estimated to contain some 800 million pages of publicly accessible information [7].

Now if in 1999 there were already 800 million pages, in the speed the
web explodes, there must be many more than a billion pages in 2001, although it is difficult to guess how many.

But even if double and triple or a multiple amount of pages or documents linked become available on and via the Internet, it is agreed that only a very small percentage of the human knowledge will ever be available online.

This is already indicated by the famous Jewish Biblical commentator
RASHI of Worms/Germany, explaining why the Old Testament started with the Hebrew letter "b", which is a square open only on the left [8].

Ideally it would be desirable for an investigator that all human knowledge be put on the Web.

But this is an impossible task. Not only are the capacity resources insufficient for such a monumental task at present, most likely the needed resources will never be available, partly because of financial as well as
linguistic reasons.

Old documents may not suitable for scanning without being damaged nor
the scanners good enough to understand the old scripts.

Searching for heirs is an important investigative field and here a major
tool are old documents. The writer of this article had to find possible kins of a person who died in the 1980ies in the USA, leaving no heirs. Immediate relatives were also unknown. So going back to the 19th Century covering parts of France and Germany, searching in old civic register archives with documents at times in part hardly legible, a family tree could be developed and the aim of the search successfully attained.
Although in some fields of negligible importance not only the availability
of information online is restricted, but because of financial reasons some
hosting providers have started to restrict their facilities to those
who pay and be it only for the URLs to be listed.

Followed by Alta Vista Yahoo has recently started to charge US $199 per
annum for just listing a URL of a website. If the fee is not paid, the URLs are rigorously erased from their search engine, as the writer of this article has experienced. So quite a number of sites containing valuable knowledge are lost to the online public.

Another impeding factor is that information is not updated be it a com-
pany's website perhaps because the PR manager just does not pay attention
to this modern essential advertisement tool, or telephone numbers, partly
because the financial means are not at hand to make the changes as quickly
as to be really of use.

A much more important hindrance in accessing knowledge by investigators
and other segments of the public is that knowledge has often restricted
access either to a special field of activities (surgery information only
for surgeons or multi-media information to multi-media providers), but
also the fees levied, too high for certain users, or for instance the linguistic barriers or lack of equipment able to read e.g. the Cyrillic letters. Ideally of course it would be for investigators not to have to "fight" or be confronted by such inhibitors to execute his job not only easier and quicker, but in some not so seldom instances better and more successfully than otherwise.

Anybody Could Be a Terrorist...At Least to the Pigs

Law-enforcement authorities have fielded 435,000 tips as of Nov. 6, and detained more than 1,100 people. The Justice Department recently drew up a list of 5,000 "Middle Eastern" men it wants to question further.



Nov. 21 - Maybe it was something, maybe it was nothing, thought Himanshu "Bobby" Shah, manager of the Best Western Maryland Inn in College Park, Md. On the very day that terrorists staged attacks on the World Trade Center and the Pentagon, Shah noticed that a hotel guest had abandoned his folding suitcase and backpack outside Room 157 on the ground floor. The man, who had paid $77 cash for his room and shown an Egyptian passport as I.D., had checked out a few hours earlier.

SHAH WALKED PAST the bags, sitting in a covered outdoor walkway, several times. "You don't just leave your luggage outside half a day," he thought to himself. After a maid and a groundskeeper also mentioned the bags, the 28-year-old native of Gujarat, India, began to worry: What if his employees doubted his patriotism? "I want them to understand that I care for their safety. They might be thinking, 'Bobby's a foreigner. Why isn't he taking the right step?' "

Taking the right step has become a lot more complicated in the weeks since Attorney General John Ashcroft asked Americans to report any suspicious activity that might involve terrorism. Law-enforcement authorities have fielded 435,000 tips as of Nov. 6, and detained more than 1,100 people. The Justice Department recently drew up a list of 5,000 Middle Eastern men it wants to question further.

Sometimes the tips net tantalizing leads, such as the case of the community-college English professor in California who noticed that a student had written the first names of two of the hijackers in his exam booklet. The FBI was called, helping connect some dots: The student's phone number also showed up on a scrap of paper in the glove compartment of a hijacker's abandoned car at Dulles International Airport. The student has since admitted meeting one of the hijackers and was indicted for lying to a grand jury about not knowing the other. An FBI spokesman calls the tip program "helpful," and says the agency "still appreciates any information that the public wishes to provide."

But often, the leads have resulted in the detention of men who aren't terrorists at all, but minor immigration violators. The rampant informing is a reminder that when people are looking for something suspicious, almost anything can start to look fishy.

Questions have emerged in some cases about the motives of the tipsters themselves. La-Tennia Abdelkhalek, an American-born cook at a Rafferty's restaurant in Evansville, Ind., called the FBI on Oct. 11 with
a startling story: Her husband Fathy, an Egyptian waiter at the Olive Garden, seemed despondent and had told her he was "going to crash." The FBI moved swiftly, arresting not only Abdelkhalek, but eight of his friends, all of whom were former members of the Egyptian national rowing team who had relocated to Evansville.

All were arrested as material witnesses and locked up in a federal detention center in Chicago. Lawyers for the nine men say they were suspected of being members of an "Evansville cell" plotting to blow up the Sears Tower. But eight of the nine were released after eight days; one was still held on immigration charges.

Abdelkhalek's friends think his wife blew the story out of proportion because she was angry that Abdelkhalek hadn't been forthright about his immigration problems and another family he had in Egypt before he married her. "She screwed all of us, because she was mad Fathy had children and was sending them all his money," says Hashem Salem, a waiter at the Texas Roadhouse, an Evansville steakhouse, who was among the nine detained. La-Tennia Abdelkhalek calls Salem's assertion "ridiculous" and says she'll take her husband back if he wants. (His friends say he has since landed in detention again because INS officials deemed his marriage a sham.)

Ross Rice, a spokesman for the Chicago FBI, says that once La-Tennia Abdelkhalek passed a polygraph test, investigators didn't care about her motives for coming forward. "There are more men in jail right now because an ex-wife or an ex-girlfriend decided to rat them out," Rice said. "It doesn't mean they don't deserve to be there."

The FBI's call for help in cracking the anthrax case has led to a raft of unusual tips.

After the agency announced a $1 million reward for useful information in that case - since raised to $1.25 million - Stan Kiszka, a 58-year-old brick mason in North Trenton, N.J., got to thinking about the Middle Eastern-looking man who lived down the street. More than six weeks after the attacks, he called 911.

"Right before the bombings, he had four guys visit him in a white car, a compact thing like a Neon or a Previa or something, and it had Florida tags," Kiszka says he told the dispatcher. "Then, right around the bombings, this guy disappears for a couple of days."

He added: "Before that, the afternoon of Sept. 7, I saw this guy carrying a small plastic sandwich bag with an envelope inside of it out to his car, place it real gently on the passenger seat like it was a baby or something, then look around, lock the car and go upstairs."

By 8:30 that morning, two Trenton city detectives were at Kiszka's front stoop. Ten minutes after they left, they called to tell him not to go to work yet, that the FBI wanted to hear his story. Two FBI agents soon showed up.

Neighbors say the two agents staked out the predominantly Polish block for the next four days. On Nov. 3, about 10 police officers and five federal agents surrounded a small apartment building up the block and presented a search warrant at the second-floor unit of Allah Rakha, a 43-year-old gas-station attendant from Pakistan. They searched and questioned Rakha and his brother, Ilyas Chaudhry, who have shared the $750 unit with two cousins for nearly six years.

A hazardous-materials crew took swabs of the apartment and its mailbox for anthrax testing. They confiscated some prescription cold medicine from the bathroom. And Rakha, who was in the process of getting his expired work visa renewed, was handcuffed and taken into Immigration and Naturalization Service detention at Hudson County Jail in Kearny, N.J.

By Nov. 6, an FBI spokeswoman said, the FBI had cleared Rakha of any connection to anthrax or Sept. 11, although he remains in jail pending an immigration hearing. Rakha couldn't be reached for comment.

Kiszka doesn't feel bad about his handiwork. If Rakha is an "illegal alien," he says, he can't do anything about that.

Sometimes, jumpy neighbors end up telling on people with odd habits. People in the community of South Ozone Park, in Queens, N.Y., whispered for more than a year about the big group of men in the little house, the ones who kept the blinds drawn, who never said "hello" to the neighbors, who kept weird hours and didn't cut the grass. Last summer, a police officer who lived across the street ran a check on the license plate of one of the cars in the driveway just to see if it was stolen. It wasn't.

"They were very strange," says Nick Libramonte, a 63-year-old wedding-gown designer who lives across the street from the little house and, since he works from home, keeps an eye on the comings and goings on his street from his big bay window. "They hang their laundry - even their underwear - on the fence. Who does that?"

Then Sept. 11 happened. Some neighbors say suddenly more men showed up at the little house. People definitely got suspicious. A day or two later, Father James Mueller, the priest of one of the neighborhood Catholic churches, St. Anthony of Padua, called the FBI. "I told them, 'This is weird, and people are frightened and here's the address," ' Father Mueller said.

Father Mueller said he wasn't just acting on his own suspicions. A confluence of events prompted his call to the FBI. First, one of his parishioners - he won't say who - came to him with concerns about the men. Father Mueller shrugged it off. Then more parishioners came to him. Father Mueller did his own reconnaissance. "There was all this coming and going. The lights were turned off," he says. "The house just didn't look right." He didn't try to talk to any of the men. He didn't know their names or even how many people lived in the house.

Father Mueller was worried about the kids. St. Anthony's nursery school and its 80 children are just a few doors down from the house. People were shaken and mourning - St. Anthony lost two members in the disaster. "We have 6,000 people dead, and these people could be involved," said Father Mueller, adding that he prayed about what to do. "I don't want these guys running around and blowing up other things."

The FBI won't confirm that it acted on Father Mueller's tip. But one of the house's residents, Muhammad Rafiq Butt, a 55-year-old native of Jehlum, Pakistan, was taken into custody on Sept. 19 and interviewed by the FBI. After the FBI decided it wasn't interested in Butt, he was held on an immigration violation at the Hudson County Jail.

Butt had entered the U.S. on Sept. 24 of last year and had overstayed his six-month visa. On Sept. 20, the INS filed a notice requiring Butt to appear before an immigration judge. Butt initialed an INS document admitting that he was in the U.S. illegally and stating his desire to return home. But on Oct. 23, Butt died in prison of an apparent heart attack.

Father Mueller, a big barrel of a man, says he feels sorry for Butt and has prayed for him and his family. But even knowing the outcome, he says he would do it all over again. "This is very sad for the family, sad for him, but he could have dropped dead in the street," Father Mueller says. "I don't think these people meant any harm, but when you act suspicious constantly in times of crisis you bring it on yourselves. They could have been making anthrax by the ton in there."

At the Maryland Best Western, Shah, a trim, neat man with wire glasses and preppy olive pants, felt a tug of conflicting emotions over his Egyptian guest. He himself has suffered slights based on his slightly dark skin and Arabic-sounding name. Once or twice, he says, guests have dropped off comment cards complaining that the hotel "is being run by foreigners and isn't as good." Like most Indians, he is Hindu, not Muslim, and bristles when people assume he is an Arab. Since the bombings, he says, Indians "are getting pretty bad stares ourselves."

The day after he spotted the luggage, Sept. 12, Shah made his decision. Two FBI agents and a police detective came by the Best Western during a sweep of Washington-area hotels for the names of about 16 terrorists on recent guest registries. Shah found none of the names in his computer, but told the agents he had a tip for them.

The Egyptian man who stayed at the Best Western, Ahmed Abouelkheir, had flown into New York Sept. 7 on a tourist visa that allowed him to remain in the U.S. for six months at a time. In an interview, Abouelkheir says he wanted to find an employer willing to sponsor him for permanent residence. The same age as Shah, 28, he himself has a degree in hotel management from
a Cairo institute, he says.

Upon arriving in the U.S., Abouelkheir says he went to Maryland to look for a former roommate from a prior visit, only to find that strangers were living there and had no space for him. After spending one night wandering the parking lot of a shopping center to save money, he says he took a room at the Best Western. When he left two days later, he was bound for Washington, D.C., to look for fellow Egyptians who might have a room to rent.

He says he left his luggage outside his room only temporarily to grab lunch at a Burger King across the street, assuming the maids would watch it. Before he set out for Washington, he says, the staff had already put his luggage behind the front desk. He says he was only vaguely aware of a problem in New York because he hadn't been watching TV, or he wouldn't have acted so "freely."

Shah, the hotel manager, says he knew none of this when he spotted the luggage. He was slightly comforted when the Egyptian returned and checked into the hotel again on Sept. 14. By then the police had the luggage. Alerted to Abouelkheir's return, the FBI found the hotel guest the next day buying pizza and hot chocolate at a convenience store across the street. They questioned him and let him go, both Shah and his former guest say. An FBI spokesman in Maryland declined comment on his case. Shah told his staff, "If he is a threat, the FBI wouldn't have let him go. You have to trust your government."

Still, employees didn't feel comfortable with the Egyptian back on the premises. Shah says the man continually walked around the grounds. On Sept. 16, a maid knocked on his door and told him it was checkout time, according to both Shah and Abouelkheir. What happens next is in dispute: Abouelkheir says the maid became agitated and "waved scissors in my face" and said, "You have to leave." Shah says that couldn't have happened because the hotel doesn't put scissors on the maid's cart.

"Of course they are going to say no," it didn't happen, Abouelkheir retorts. But he adds: "I was just washing my face, preparing to leave. I'm
a customer. She shouldn't treat me like that."

The hotel called the police that day, and officers told Abouelkheir to leave. But over the next few days, says Shah, the Egyptian kept coming back on the property. "By that time my employees were freaked out," he says.

Abouelkheir's explanation: He was trying to locate the authorities who had his suitcase, which contained his passport, plane ticket and about $50. He had been given a number to page the FBI agent, but says he couldn't do it from the pay phone at the convenience store because it didn't appear to be accepting incoming calls. He couldn't afford another night at the hotel and so he asked a hotel bartender if he could borrow a phone, he adds.

Finally, on Sept. 18, a week after the hijackings, Shah called the FBI again. "He's here again," he told them.

The Prince George's County Police Department arrested Abouelkheir during another foray to the convenience store. They charged him with trespassing and held him in a detention center in Upper Marlboro, Md., for about six days. He was repeatedly questioned by the FBI about his multiple trips to the U.S. and about everyone he had ever known in the U.S.

Six days later, the county dropped the charges. But soon, he says, federal agents escorted him to a small commuter plane in handcuffs and shackles, and flew him to the Metropolitan Correctional Center in Manhattan, where he was held on a material-witness warrant in the terrorism case.

Abouelkheir says the FBI spent days showing him photographs and asking him about an acquaintance, Mohamed Moustafa, an Egyptian bank clerk who had helped him find a roommate the prior year in College Park. Abouelkheir says they told him Moustafa was actually Ziad Jarrah, one of the men who hijacked the plane that crashed in Pennsylvania Sept. 11. "I told them no, he is a very good man," says Abouelkheir.

Then, just as suddenly, the government dropped the warrant. Abouelkheir's attorney, Martin Stolar, says the FBI found Moustafa alive in the Midwest. Moustafa couldn't be reached for comment.

Still, Abouelkheir's ordeal wasn't over. The day the warrant was dropped, he was transferred to Bronx County Criminal Court in New York City because authorities discovered he hadn't paid a $250 fine for a disorderly conduct violation three years earlier. The judge issued a conditional discharge, but by that time, the INS had issued a detainer forbidding Abouelkheir's release. The INS filed documents alleging that Abouelkheir had worked "without authorization" from the INS on a prior visit to the U.S., and that "therefore he is deportable."

Abouelkheir acknowledges he worked briefly in a pizzeria and at an Indian restaurant as a dishwasher. While the INS processed his transfer to Passaic County Jail in Paterson, N.J., he spent the weekend on Rikers Island.

When Shah, the Best Western manager, heard about the Egyptian's ordeal, he was surprised. "They told me he was released," he says. But Shah says he has no regrets. "Actually, no, I don't feel bad about it. I was just told to report anything suspicious. So I did," he says.

As for Abouelkheir, he's now in a cell with about 40 other detainees. "I have to be quiet and patient," he says, "because if I'm going to think too much I'm going to be sad."